Enable DNSSEC Validation

MediumLevel 1Automatedbind

Description

DNS Security Extensions or DNSSEC for short provides authentication of the name servers through public key cryptography. With DNSSEC, the name server signs its responses with its private key. This allows other name servers that have the public key of the name server to verify the integrity and authenticity of the response. The audit fails when dnssec-validation or dnssec-enable is set to no (the BIND 9.11 defaults validate); the PDF also suggests the delv @127.0.0.1 isc.org "fully validated" test. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

How it is checked

Audit method: Shell command

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-validation no;' && { echo 'dnssec-validation no'; exit 1; }
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-enable no;' && { echo 'dnssec-enable no'; exit 1; }
echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Perform the following for remediation: ; Check the BIND configuration files, and in the global options set the option dnssec- enable to yes, and option dnssec-validation to either yes or auto as shown below. The auto setting is generally preferred as the trust anchor will not need to be manually configured. dnssec-enable yes dnssec-validation auto ; Restart the named server.

Properties

Operating systems: Any
Tags: binddnsdnssec
Reference: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.2 Enable DNSSEC Validation

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target bind